DETECTION PATH ANALYZER

Telemetry flow from host endpoint actions through Wazuh parsing to security alerts.

BASELINE STATE
AFTER BASELINE
FIM MODE
01 // HOST ACTION 02 // WAZUH OBSERVATION 03 // DETECTION OUTPUT BASELINE IGNORE POLL DELAYED REALTIME ALERT SYSLOG RULE_1002 DEB/RPM MATCH FILE_PRE_BSL FILE_POST_BSL SUDO_EXEC PKG_VULN SCHED_FIM RT_FIM EVT_LOG VULN_FEED NO_ALERT CRITICAL_ALERT LOW_NOISE_ALERT CVE_RISK
INSPECTOR // TELEMETRY PAYLOAD MODE: ACTIVE
Click any node or connection path to inspect telemetry payloads, raw events, and timing latency gaps.